fix: detect HTTP 403 Cloudflare challenge before JSON parse in login

A 403 from the SSO/mobile host is a Cloudflare bot challenge returning a
non-JSON HTML page, so r.json() threw before the CAPTCHA_REQUIRED check
could run — surfacing as a confusing "login failed (non-JSON): HTTP 403".

Detect 403 explicitly (same class as 429/CAPTCHA) and raise a clear
bot-challenge error that falls through to the next strategy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cyberjunky

garminconnect/client.py

@@ -398,6 +398,12 @@ def _do_mobile_login(self, sess: Any, email: str, password: str) -> None:
                 "Mobile login returned 429 — IP rate limited by Garmin"
             )
 
+        if r.status_code == 403:
+            raise GarminConnectConnectionError(
+                "Mobile login: HTTP 403 (Cloudflare bot challenge) — "
+                "falling through to next strategy"
+            )
+
         try:
             res = r.json()
         except Exception as err:
@@ -731,6 +737,12 @@ def _do_portal_web_login(self, sess: Any, email: str, password: str) -> None:
                 "Portal login POST returned 429 — Cloudflare blocking this request."
             )
 
+        if r.status_code == 403:
+            raise GarminConnectConnectionError(
+                "Portal login: HTTP 403 (Cloudflare bot challenge) — "
+                "falling through to next strategy"
+            )
+
         try:
             res = r.json()
         except Exception as err: